…with Apple and Microsoft, Mutahar’s turn to take a look at “Web Environment Integrity”

  • MaliciousKebab@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    57
    arrow-down
    2
    ·
    1 year ago

    Yesterday I saw a meme on reddit about browsers and I did not see even one person mentioning this WEI shit. Everyone was praising Chrome. We are truly fucked.

    • Qvest@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      One thing I don’t understand about all of this WEI: can’t we just use a user agent switcher / spoofer to ‘look’ like chrome or any other browser and OS to counter this?

      • Freakmiko@lemmy.world
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        This isn’t about a user agent. In basic terms there is supposed to be some kind of software that attests that the browser is actually what it claims to be. On the other side, a server can trust this “attester” or not. So even if you wrote software that always attests what the browser claims to be, Netflix for example could say “nah, I don’t trust you bro”.

        On Android this attestation would be done by the Google play services (afaik). On desktop, the OSs would need to implement this attestation.

        Please someone correct me if I’m wrong on this.

      • sloppy_diffuser@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        While I haven’t seen data to back this up, another Lemmy user called out that Intel chips may have support for running secure code the user cannot modify. The results are signed by an encryption key on the motherboard/CPU that cannot be extracted to fake the signature.

        So let’s say Chrome asks this hardware module to hash the executable code and some state for itself currently in RAM and sign it with Intel’s private key on the motherboard/CPU. The “some state” portion ensures the hash is always unique. Maybe it is just a timestamp. Regardless, this helps the attestation server know Chrome has not been modified because the hash is unique and cannot simply be captured in flight once and then replayed/faked over and over like a user-agent string.

  • MyOpinion@lemm.ee
    link
    fedilink
    English
    arrow-up
    22
    ·
    1 year ago

    I have finally made the full conversion away from Google. Email, browser, search all out of their hands. The one that took the longest to happen was the browser. Firefox finally is working great for me now.

    • skomposzczet@lemm.ee
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Email is tough one for me. Any recommendations? I tried Proton but their mobile app is (was?) disaster, and only limited to one logged in account at once which is a deal breaker for me.

    • jflorez@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      48
      arrow-down
      1
      ·
      1 year ago

      The best way to oppose this is to use non-chromium browsers like Firefox and take away Google’s source of power: chromium market share

      • mishimaenjoyer@kbin.social
        link
        fedilink
        arrow-up
        17
        ·
        1 year ago

        i agree, the problem is, that if google succeeds and (popular/mainstream) websites refuse to let said browsers access the sites, it’s an uphill battle in wich we will eventually lose the normie webizens.

        • gravitas_deficiency@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          16
          ·
          1 year ago

          And there’s the core problem: the proportion of people on the internet who have no idea what they’re doing has grown by orders of magnitude, and big tech has realized they can just treat and exploit them like cattle, because almost nobody has a full and complete understanding of what’s going on, or how policies driven by big tech like this are catastrophically bad for normal users on the internet.

    • aluminium@lemmy.world
      link
      fedilink
      English
      arrow-up
      30
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Apple only opposes Google when new browser capabilites like PWAs, Bluetooth API, NFC API,… might be a threat to the Appstore monopoly on iOS.

      I think they are very much onboard with this since it you could potentially make live hell for Hackintosh and Jailbreak users.

      • mishimaenjoyer@kbin.social
        link
        fedilink
        arrow-up
        9
        arrow-down
        2
        ·
        1 year ago

        i wouldn’t be so sure about it. apple strongarmed google with jpgxl support and the european union pryed open their eco system, at least for eu citizens. apple currently positioning themselves on the side of privacy advocates would lose this standing (and many customers who switched to iphone because of it). i know, they could sugarcoat this, but i have a little hope left that they will draw a line on at least the most user hostile stuff.

        • Sjoerd1993@lemmy.world
          link
          fedilink
          English
          arrow-up
          18
          arrow-down
          1
          ·
          1 year ago

          Honestly my hope is still that the EU intervenes, which I consider to be around 50% given they’re a generally a bit of a mixed bag when it comes to regulations.

          When Apple becomes my last hope, I’ll know times are bad. Having said that, it’s one of the parties that may actually oppose. The other big guy that may have some power in this, Microsoft, is probably more likely to adapt this catastrophe of an idea.

          • glockenspiel@lemmy.world
            link
            fedilink
            English
            arrow-up
            6
            arrow-down
            1
            ·
            edit-2
            1 year ago

            Apple already shipped attestation. It’s in Safari in both desktop and mobile. Unfortunately. It’s just going to take a couple big players to make this a blight everywhere. Netflix implementing this might do it. Google’s main sites would work.

          • mishimaenjoyer@kbin.social
            link
            fedilink
            arrow-up
            4
            arrow-down
            1
            ·
            1 year ago

            the EU can be really schizo when it comes to stuff like that, that’s true. i don’t trust them. and apple as a last hope … well, maybe when it comes to big tech. can’t think of anything better within the FAANG pantheon.

        • cyd@lemmy.world
          link
          fedilink
          English
          arrow-up
          12
          arrow-down
          3
          ·
          1 year ago

          Apple loves control; the only reason I can think of that would make them oppose Google’s Web Integrity proposal is that they don’t think it goes far enough.

          • thedrivingcrooner
            link
            fedilink
            English
            arrow-up
            5
            arrow-down
            1
            ·
            1 year ago

            Or they’ll come out with their own and try to be the dominant WEI code.